1111
Topics /
Security & Privacy
The most popular blog posts about security & privacy on Hacker News. 4,333 posts.
1112
Pwning the Ladybird Browser
Ladybird is a relatively new browser engine originating from the SerenityOS project . Currently, it’s in pre-alpha and improving quickly. Take a look at the website and the GitHub for more information!
1113
Abolish the Department of Homeland Security
I have a love/hate relationship with the Cato Institute. Most of their analysis I strongly disagree with, but some of it I equally strongly agree with. Last September 11—the tenth anniversary of 9/11—Cato’s David Rittgers published “Abolish the Department of Homeland Security“: DHS has too many subdivisions in too…
1114
I use C when I believe in memory safety
I am using C for a professional project. I believe in memory safety. Yes, I'm a hypocrite, but please, let me explain.
1115
BusKill: A kill cord for your laptop
BusKill is a Kill Cord for your laptop implementing a Dead Man Switch using $20 in USB hardware + udev rule to trigger your laptop self-destruct if stolen.
1116
The Reluctant Sysadmin's Guide to Securing a Linux Server
I wrote a follow-up to this guide, which you should probably consider along with this article.
1117
My audio interface has SSH enabled by default
I bought a Rodecaster Duo to solve some audio woes, and found that it has ssh enabled by default. I captured the firmware update process and created custom firmware to enable password authentication for ssh.
1118
IPinside: Korea’s Mandatory Spyware
Banking websites in South Korea can only be used with IPinside installed. This application collects lots of data about the user, and it makes that data accessible to each and every website. The protection is inadequate.
1119
Equifax Argentinian portal secured with admin/admin
Equifax last week disclosed a historic breach involving Social Security numbers and other sensitive data on as many as 143 million Americans. The company said the breach also impacted an undisclosed number of people in Canada and the United Kingdom. But the official list of victim countries may not yet be complete…
1120
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin…
1121
Captchas are Becoming Ridiculous
I am a software engineer based out of Seattle, WA
1122
Bucketsquatting is finally dead
For a decade, I have been working with AWS and third-party security teams to resolve bucketsquatting / bucketsniping issues in AWS S3. Finally, I am happy to say AWS now has a solution to the problem, and it changes the way you should name your buckets.
1123
1124
Improving the security of your SSH private key files
Update (July 2015): This post is now rather outdated, and the procedure for modifying your private key files is no longer recommended. A better solution is to use ssh-keygen -o .
1125
No Source Code == No Patent
How we know you "have' the invention
1126
What Do You Agree to When You Accept All Cookies
I have been writing software for exactly twenty years now. In the course of this I have learnt very many things, which I hope to journal over time.
1127
UCOP Ordered Spyware Installed on UC Data Networks
The San Francisco Chronicle has coverage of an issue that has been circulating on faculty email networks at UC Berkeley for a few days. ...
1128
1129
1130
Why Static Websites Need HTTPS
It was Jan last year that I suggested HTTPS adoption had passed the "tipping point" [https://www.troyhunt.com/https-adoption-has-reached-the-tipping-point/], that is, it had passed the moment of critical mass [https://en.wikipedia.org/wiki/The_Tipping_Point] and as I said at the
1131
1132
Attorney General Barr and Encryption
Last month, Attorney General William Barr gave a major speech on encryption policy—what is commonly known as “going dark.” Speaking at Fordham University in New York, he admitted that adding backdoors decreases security but that it is worth it. Some hold this view dogmatically, claiming that it is technologically…
1133
Attacks against machine learning – an overview
This blog post surveys the attacks techniques that target AI (Artificial Intelligence) systems and how to protect against them.
1134
Infectious Executable Stacks
In software development there are many concepts that at first glance seem useful and sound, but, after considering the consequences of their implementation and use, are actually horrifying. Examples include thread cancellation , variable length arrays , and memory aliasing . GCC’s closure extension to C is another…
1135
Elliptic Curve Cryptography for Beginners
A description of ECC without using advanced math
1136
Don't tell people to turn off Windows Update
You know what really surprised me about this whole WannaCry ransomware problem [https://www.troyhunt.com/everything-you-need-to-know-about-the-wannacrypt-ransomware/]? No, not how quickly it spread. Not the breadth of organisations it took offline either and no, not even that so many of them hadn'
1137
T-Mobile: Breach Exposed SSN/DOB of 40M+ People
T-Mobile is warning that a data breach has exposed the names, date of birth, Social Security number and driver’s license/ID information of more than 40 million current, former or prospective customers who applied for credit with the company. The acknowledgment came less than 48 hours after millions of the stolen…
1138
1139
Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep , an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity…
1140